Using Cookies to Store Your Postman Secrets
summary
Three demos show how to keep API keys off the cloud: hard‑coding headers (bad), using local environment current value (works but risky if initial value is set), and storing a UUID secret in Postman cookies (must be whitelisted) then using pre‑request scripts and crypto.js to AES‑encrypt the key into an environment variable. A Node.js helper can generate the encrypted blob. Each method calls an API Gateway + Lambda echo endpoint and returns 200 OK; the cookie+crypto approach keeps the plaintext secret local.
AI-written summary · about
chapters (12)
- 0:00Introduction to talk
- 1:01Postman security features
- 2:28Using sessions and cookies
- 3:11Demo setup overview
- 3:53Storing secrets in headers
- 4:57Environment variables for secrets
- 6:00Cookies for temporary secrets
- 7:24Encrypting secrets with crypto.js
- 9:56Encryption entirely in Postman
- 12:49Summary of cookie methods
- 13:11About the speaker
- 14:17Q&A session
related talks
26mHow To Keep A Secret
16mElevate enterprise DX with AI-powered and secure API collaboration
18mAuthentication Showdown: Who Rules the Cookie Kingdom?
23mKeeping secrets with JavaScript
55mHandling secrets in cloud-based applications
10mCan you keep it a secret?
47mManaging your Secrets in a Cloud Environment
34mThe Secret Life of Secrets